CVE-2026-104025

Name of the Vulnerable Software and Affected Versions PeaZip versions prior to 11.2.1

Description On Windows, a path traversal issue exists in the execute obj() function of the archive object viewer (peach.pas). An attacker can execute an arbitrary program already present on the victim's system by convincing them to preview a crafted archive entry using the "Preview with... -> Associated application" action (Shift+Ctrl+O). The issue occurs because the checkfiledirname() function in list utils.pas fails to perform a ".." path-containment check, allowing the tempstring variable—taken directly from the archive entry name—to escape the temporary extraction directory when concatenated with outname. This resolved path is then passed to ShellExecuteW via cp open(). Furthermore, the dangerous-extension confirmation prompt is missing from this specific preview route, allowing executables to run without warning. This behavior was confirmed across multiple archive formats, including .zip and .tar.

Recommendations Update PeaZip to a version newer than 11.2.0. As a temporary mitigation, avoid using the "Preview with... -> Associated application" action (Shift+Ctrl+O) when viewing archives from untrusted sources.